THEMECO vulnerabilities and threats

CVE-2026-54185 is a high severity SQL Injection vulnerability affecting THEMECO Cornerstone versions prior to 7.8.8. The flaw allows improper neutralization of special elements in SQL commands, specifically in the Subscriber functionality. This vulnerability can be exploited remotely with low attack complexity and requires low privileges but no user interaction. It impacts confidentiality with high severity and availability with low severity, while integrity is not affected. No official patch or remediation guidance is currently confirmed from the vendor. Users should monitor vendor advisories for updates and apply patches once available.

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THEMECO Cornerstone cornerstone allows Stored XSS.This issue affects Cornerstone: from n/a through <= 7.7.3.